Dutch Tax Authority Drops Microsoft 365 Cloud Plan for On-Premises and Open Source

State Secretary for Finance Eelco Eerenberg told Parliament that the Tax and Customs Administration (Belastingdienst), Customs (Douane) and the Benefits Service (Toeslagen) are dropping the planned Microsoft 365 move. They will use an on-premises solution combined with open source instead. The 2026 Microsoft 365 rollout is not just paused anymore. It has been replaced by a different plan.

What was actually decided​

The plan has two stages:

• 2027, first stage: Mail and calendar are built on-premises first, next year. They will run on servers owned by the Belastingdienst or servers the agency controls itself.
• Late 2027 and 2028, second stage: European open source solutions follow for personal storage and collaboration.

Neowin reports that the on-premises mail and calendar will still rely on Microsoft software such as Outlook. That fits what the Dutch trade press reports about the approach. It aims to use existing licenses as much as possible, to limit extra investment. In practice this looks like a hybrid Microsoft footprint, not a clean break.

The sources I reviewed don't name the open source products. They also give no detailed migration architecture or cost figure. Treat any claim about specific replacements, such as a named office suite, as speculation for now.

Why the cloud plan collapsed​

The Netherlands' Advisory Board on ICT Assessment (AcICT) published its advice on 29 June 2026. It concluded that the current approach doesn't produce a suitable working environment and gives too few guarantees for a secure, future-proof solution. Its published summary says the information security setup falls short on both confidentiality and availability. It also says a single total solution with no workable exit strategy leads to vendor lock-in and concentration risk. Its recommendations were to reverse the public-cloud rollout and to make choices on a growth path by the end of 2026.

Neowin's summary of the board's detailed concerns includes:

• Email confidentiality.
• Sensitive data ending up on US servers.
• Gaps in encryption.
• "Aggregation risks" from metadata.
• Backups that "fall seriously short."

Treat these as findings about this agency's own configuration and classification practices. They are not a verdict on every Microsoft 365 tenant, and they are not evidence that a breach occurred. The board's own summary says the platform does lay a foundation for a modern workplace with better collaboration. It judged the setup unsuitable for this particular organisation.

The summary says the workplace had already been rolled out to roughly 5,000 employees. Neowin reports those users stay on Microsoft 365 for now.

How the timeline unfolded​

1. 2025: The Dutch government chose Microsoft 365 for office automation. The agency's primary systems would stay on-premises, while only office automation moved to Microsoft 365.
2. Late June 2026: AcICT publishes its critical advice.
3. Early-to-mid July 2026: The Microsoft 365 programme is "paused for now," pending a look at an on-premises scenario. An evaluation was set for six months out.
4. Early October 2026: The government commits to on-premises plus open source.

On 11 June 2026 the government had also published a wider digital autonomy strategy for the agency. It leans on in-house development, expanded data center capacity and more open source. Eerenberg was frank about the limits: the agency will stay dependent on non-European technology for years, especially in infrastructure, or words close to that. That qualifier appears in his own announcement, in Dutch. The same announcement says pursuing autonomy must not come at the expense of information security or service continuity.

The catch: archiving and records management​

The pivot has costs. Some of the planned records and information-management features in the Microsoft 365 package aren't available on your own servers. The agency is investigating how to replace those functions, and Eerenberg will report back in the next progress letter at the latest. Sovereignty has a price in schedule and capability, and this is a concrete example of it.

The board also raised workload as a limit. Eerenberg wants to gradually cut the share of capacity for essential modernisation to at most 20 percent, and raise strategic renewal to at least 20 percent. He cautioned that this doesn't mean everything can be implemented at once. Parliament debates the subject on 7 October. A roadmap with concrete prioritisation follows in the first quarter of 2027.

What this means for Windows and Microsoft admins​

My analysis below draws on general industry experience. The sources don't state it.

• Hybrid is the realistic outcome. Even a determined sovereignty push ends up keeping Microsoft client software and server products in the mix. The pressure falls on where the data lives and who controls the servers, not necessarily on the brand of the app.
• Exit strategy is now a procurement criterion. AcICT's argument is about lock-in and the ability to leave. Tenants in regulated sectors should expect auditors to ask for documented backup, restore and exit plans that don't depend on the same vendor.
• Check your own configuration. Encryption options, data classification and backup independence were central to the board's critique. These are things any Microsoft 365 administrator can review in their own tenant, regardless of politics.
• On-premises isn't free. Running your own mail and calendar means patching, availability, capacity and security stay with you. Missing features, like the archiving tools above, are a real risk.
• Replacing Teams and Office-style collaboration is hard. Neowin points to reports that European Commission officials dislike Element Pro, a proposed Teams replacement. That's a reminder that user acceptance can sink a migration. The Dutch plan reportedly wants open source options by function, not one big suite swap.

The bottom line​

This is a staged plan, not a finished migration. Mail and calendar go on-premises in 2027. Storage and collaboration alternatives from open source follow into 2028. The motives are the AcICT security and lock-in findings, plus new data center capacity that makes self-hosting feasible. Whether it works will depend on the unresolved details: product choices, the archiving gap, cost and user acceptance. Those should become clearer with the early-2027 roadmap.